PROCESS INSTALLATION NETWORK INTRUSION DETECTION AND PREVENTION

• US 20130094500A1
• Filed: 10/13/2011
• Published: 04/18/2013
• Est. Priority Date: 10/13/2011
• Status: Active Grant

• Current Assignee: Rosemount Incorporated (Emerson Electric Company)
• Original Assignee: Rosemount Incorporated (Emerson Electric Company)
• Inventors: Rotvold, Eric D., Potter, Jeff D.
• Granted Patent: US 9,270,642 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/125 Protection against power exhaustion attacks
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A process communication device includes a process communication interface for communicating on a process communication loop in accordance with a process communication protocol. A controller is coupled to the process communication interface. A rules store is coupled to the controller, and has at least one process communication packet rule that is based on the process communication protocol. The controller applies the at least one process communication packet rule to at least one process communication packet received from the process communication interface, and generates event information when a process communication packet fails at least one process communication packet rule.

Claims

1. A process communication device comprising:

a process communication interface for communicating on a process communication loop in accordance with a process communication protocol;

a controller coupled to the process communication interface;

a rules store coupled to the controller, the rules store having at least one process communication packet rule that is based on the process communication protocol; and

wherein the controller applies the at least one process communication packet rule to at least one process communication packet received from the process communication interface, and generates event information when a process communication packet fails at least one process communication packet rule.

2. The process communication device of claim 1, wherein the process communication protocol is the HART protocol.

3. The process communication device of claim 1, wherein the protocol imposes a digital signal on a 4-20 mA analog current signal.

4. The process communication device of claim 1, wherein the process communication interface is a wired process communication interface.

5. The process communication device of claim 1, wherein the process communication interface is a wireless process communication interface.

6. The process communication device of claim 5, wherein the process communication interface is also a wired process communication interface.

7. The process communication device of claim 1, and further comprising a network interface coupled to the controller, and wherein the controller is configured to forward the process communication packet through the network interface if the process communication packet passes all process communication packet rules.

8. The process communication device of claim 7, wherein the controller is configured to decrypt the at least one process communication packet before applying the at least one process communication packet rule.

9. The process communication device of claim 8, wherein the process communication device is embodied within a process communication gateway.

10. The process communication device of claim 1, wherein at least one process communication packet rule relates an allowable number of packet bytes to a process communication protocol command contained in the packet.

11. The process communication device of claim 1, wherein the at least one process communication packet rule includes an allowable command range.

12. The process communication device of claim 1, wherein the allowable command range is 128 to 240 and 64768-65021.

13. The process communication device of claim 1, and further comprising a device description store coupled to the controller, the device description store containing a plurality of device descriptions, and wherein the controller is configured to apply at least one device description based rule to the at least one process communication packet.

14. The process communication device of claim 1, wherein the process communication device is embodied within an access point.

15. A method of providing process communication protection, the method comprising;

obtaining at least one process communication packet in accordance with a process communication protocol;

applying at least one rule against the process communication packet, wherein the at least one rule is based on the process communication protocol; and

determining an event based on whether the at least one process communication packet passed each of the at least one rule.

16. The method of claim 15, and further comprising logging the event.

17. The method of claim 15, and further comprising selectively forwarding the at least one process communication packet based on whether the at least one process communication packet passed each of the at least one rule.

18. A process communication device comprising:

a process communication interface for communicating on a process communication loop in accordance with a process communication protocol;

a controller coupled to the process communication interface;

a device description store coupled to the controller, the device description store having at least one process communication packet rule that is based on a device description; and

wherein the controller applies the at least one process communication packet rule to at least one process communication packet received from the process communication interface, and generates event information when a process communication packet fails at least one process communication packet rule.

19. A method of providing process communication protection, the method comprising;

obtaining at least one process communication packet in accordance with a process communication protocol;

applying at least one rule against the process communication packet, wherein the at least one rule is based a device description stored in a process communication security device; and

determining an event based on whether the at least one process communication packet passed each of the at least one rule.

20. The method of claim 19, and further comprising logging the event.

21. The method of claim 19, and further comprising selectively forwarding the at least one process communication packet based on whether the at least one process communication packet passed each of the at least one rule.